How to mix public and private folders in a Drupal installation | Creating a private folder in Drupal
By default, Drupal serves all its files publicly via http. This means that any unauthorized user can directly access all the files through a browser by entering its path. This is also true for files which have permissions for them. The solution provided by Drupal, which is to make the entire file system private is resource intensive and can bring down the server. However there is another less costly workaround to this issue. Read on to find out more.